# Is it safe to connect your finances to an AI?

> What actually happens to your bank login, your transactions and your context when you connect Claude or ChatGPT, what can go wrong, and what a careful setup looks like.

Canonical: https://usetruenote.com/guides/is-it-safe-to-connect-finances-to-ai

The honest answer is "it depends on what's between the AI and the bank". Three questions decide it.

## 1. Where does my bank login go?

With Plaid (what ChatGPT, Truenote and most finance apps use), you type your bank login into Plaid's own window. The app never sees it. The app receives an *access token* that can only read. Truenote seals that token with AES-256-GCM before it touches the database, keeps the keys outside the database, opens it only in memory right before a Plaid call, and never returns it through any endpoint, tool, export or log.

## 2. Can anything move money?

Ask the app directly, because it's a code question, not a policy one. Truenote's integration uses only Plaid's read products: transactions, balances, investments, liabilities, recurring. There is no transfer, payment or "auth for payments" endpoint anywhere in it, so an AI couldn't move money even if asked to.

What an AI *can* write in Truenote: the spending plan, buckets (a ledger inside Truenote; nothing moves at your bank), rules, goals, notes, plans, categories. Rows it writes say which agent wrote them.

## 3. What does the AI actually see, and can I prove it?

Here's where connections differ most. In Truenote each agent gets a *grant*: which kinds of data it may read (accounts, transactions, investments, liabilities, context, documents), which accounts or businesses it must never see, and whether it may write. Exclusions are applied inside the database query, totals included, so an agent hidden from the brokerage can't infer it from net worth. New connections start read-only.

And every call, allowed or refused, lands in an append-only audit log: the agent, the tool, a summary of what it asked, how many rows came back. If you ever wonder what Claude looked at, the answer is on one page. Revoke applies to the agent's very next call.

## What can still go wrong

- **Prompt injection.** A transaction description could carry instructions ("ignore previous instructions and…"). The agent might follow them, but it can only read what it's allowed and write Truenote's own records; you'd see the calls in the log and could undo the rows.
- **Leaky text.** A visible transaction can name a hidden account in its description ("TRANSFER TO SAV ...7730"). Truenote says so on the consent screen.
- **The AI provider's side.** Whatever an agent reads, it reads into its own context under its provider's terms. Truenote never sends data to a provider; the agent fetches it.
- **Your own device.** A stolen signed-in laptop is a stolen session. Passkeys and 14-day sessions help; so does signing out.

## A careful setup

1. Connect accounts read-only through Plaid. Hide the ones the AI has no business seeing.
2. Give each agent its own connection with only the scopes it needs. Keep writing off until you want it.
3. Read the Activity log the first week. It's quick, and it's how you learn what the assistant actually does with a question.
4. Revoke anything you stop using.

More detail: [Security](/security).